CVE-2004-1008: Integer signedness error in the ssh2_rdpkt function in PuTTY before 0.56 allows remote attackers to execute...

Security readout for executives and security teams

CVE-2004-1008 is an old PuTTY client flaw that could let a malicious or compromised SSH server run code on a user's machine when that user connects with PuTTY before 0.56. Business urgency depends on whether legacy PuTTY copies still exist in administrator workstations, jump boxes, or bundled toolkits. Exposure is likely limited to environments still running PuTTY before 0.56 or downstream packages based on that code. The bundle does not provide complete affected CPEs or product inventory details, so validation must focus on local software inventory and vendor package records. Prioritize this if legacy administration workstations or old server-support images are still in use. It is not a current KEV-listed issue in the provided bundle, but the impact can be severe where vulnerable clients remain. Mitigation focus: Upgrade PuTTY installations older than 0.56.; Remove legacy PuTTY binaries from shared admin toolkits.; Apply downstream vendor updates where PuTTY was packaged..

Prepared

Jun 30, 2026, 02:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.